Guidelines to Federal Organizations on Security Assurance and Acquisition/Use of Tested/Evaluated Products

Published

August 1, 2000

Author(s)

E Roback

Abstract

Computer security assurance provides a basis for one to have confidence that security measures, both technical and operational, work as intended. Use of products with an appropriate degree of assurance contributes to security and assurance of the system as a whole and thus should be an important factor in IT procurement decisions. Two Government programs are of particular interest: the National Information Assurance Partnership (NIAP)'s Common Criteria Evaluation and Validation Program and NIST's Cryptographic Module Validation Program (CMVP). The NIAP program focuses on evaluations of products (e.g., a firewall or operating system) against a set of security specifications. The CMVP program focuses on security conformance testing of a cryptographic module against Federal Information Processing Standard 140-1, Security Requirements for Cryptographic Modules and related federal cryptographic algorithm standards.

Citation

Special Publication (NIST SP) - 800-23

Report Number

800-23

NIST Pub Series

Special Publication (NIST SP)

Pub Type

NIST Pubs

Download Paper

Local Download

Keywords

assurance, computer security, evaluation, information assurance, IT security, security testing

Citation

Roback, E. (2000), Guidelines to Federal Organizations on Security Assurance and Acquisition/Use of Tested/Evaluated Products, Special Publication (NIST SP), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=151229 (Accessed October 13, 2025)